<rdar://problem/47975502>
Created attachment 361863 [details] proposed patch.
Comment on attachment 361863 [details] proposed patch. View in context: https://bugs.webkit.org/attachment.cgi?id=361863&action=review > Source/JavaScriptCore/runtime/StructureIDTable.cpp:71 > + table()[pick].offset = m_firstFreeOffset; Why not just assign to zero?
Comment on attachment 361863 [details] proposed patch. View in context: https://bugs.webkit.org/attachment.cgi?id=361863&action=review >> Source/JavaScriptCore/runtime/StructureIDTable.cpp:71 >> + table()[pick].offset = m_firstFreeOffset; > > Why not just assign to zero? Oops. This is a bug. It should be: table()[pick].offset = head;
Looks like I should fix the 32-bit issues too. Probably something trivial.
Created attachment 361899 [details] proposed patch.
Comment on attachment 361899 [details] proposed patch. r=me
Thanks for the review. I re-tested the fixed patch with the CLI JetStream2, and perf appears to be neutral. Will land now.
Landed in r241449: <http://trac.webkit.org/r241449>.